refactor: sqlc vs raw SQL — hybrid approach (R3)

Deleted 8 genuinely unused sqlc queries (no inline equivalent):
- UpsertCurrentRelationship, ListEntitiesCapped, ListEntityStatus,
  UpdateSignalState, InsertClassification, InsertFeedback, InsertSkill,
  UpsertCurrentRelationship — all had zero call sites.

Migrated 9 inline raw SQL sites to use sqlc queries:
- GetOntology (impl.go): ListEntityTypes, ListRelationshipTypes,
  ListLifecycleDefs — replaces 3 raw pool.Query blocks with typed sqlcgen
  calls, eliminating manual row scanning.
- EndRelationship (phase3.go): EndCurrentRelationship — replaces tx.Exec
  with sqlcgen.New(tx).EndCurrentRelationship.
- checkPrecondition (impl.go): GetEntityStatus — replaces tx.QueryRow +
  manual Scan with sqlcgen.New(tx).GetEntityStatus.
- GetEntityRelations (impl.go): ListEntityRelations — replaces raw pool.Query
  + scanRelationships helper (now deleted).
- GetGraph (impl.go): ListGraphEdges — replaces raw pool.Query +
  scanRelationships.
- resolveEntityID (impl.go): GetEntityBySlug/GetEntityByID — replaces
  raw pool.QueryRow + Scan.
- createApproval (mcp/server.go): InsertApproval — replaces raw pool.Exec
  with sqlcgen.InsertApproval.

Deleted scanRelationships helper (was only used by the two migrated
graph queries above).

Regenerated sqlcgen — also picks up stale model updates (AgentSession,
SessionPlanStep, SessionQuestion, etc. from recent migrations).

Documented the carve-out in .agents/dev/CONTRIBUTING.md §SQL conventions:
sqlc is the default; raw pool.Query/Exec is reserved for LISTEN/NOTIFY,
dynamic WHERE builders, blast_radius(), and COPY.

go vet, build, httpapi/mcp/db tests all pass. -383/+170 lines.

internal/mcp/server.go

@@ -1672,12 +1672,16 @@ func createApproval(ctx context.Context, pool *db.Pool, execID, targetID uuid.UU
 	// a fresh UUID here had no matching entities row, so the INSERT silently
 	// failed, orphaning the execution and never alerting the operator. One
 	// execution maps to at most one approval, so the 1:1 identity holds.
-	if _, err := pool.Exec(ctx, `
-		INSERT INTO approvals (entity_id, subject_entity_id, action, risk_class,
-			kind, payload, status, expires_at, created_at)
-		VALUES ($1, $2, $3, $4, 'execution', $5::jsonb, 'pending',
-			now() + interval '1 hour', now())`,
-		execID, targetID, action, riskClass, string(payload)); err != nil {
+	if err := sqlcgen.New(pool).InsertApproval(ctx, sqlcgen.InsertApprovalParams{
+		EntityID:        execID,
+		SubjectEntityID: &targetID,
+		Action:          action,
+		RiskClass:       riskClass,
+		Kind:            "execution",
+		Payload:         payload,
+		TokenHash:       nil,
+		ExpiresAt:       time.Now().Add(time.Hour),
+	}); err != nil {
 		slog.Error("createApproval: insert approval", "error", err, "execution", execID)
 		return
 	}